Cloud Security Compliance & Troubleshooting
10
Security Compliance & Troubleshooting
Where data lives decides which laws govern it. Encryption, hardening, and access control decide whether it's protected. This field guide walks the compliance landscape, then the diagnostic checklist for when it breaks.
$ compliance --check pci-dss soc2 iso27001
# cross-referencing data residency, encryption, access logs
✓ least privilege enforced · ✓ TLS 1.3 · ✓ MFA required
$
Compliance & Data Privacy
Four terms — residency, sovereignty, localization, locality — get used almost interchangeably, but the exam draws real lines between them.
General legal concerns for cloud data
- Business/personal data loss or exposure · HR information exposure · Breach liability · Intellectual property · HIPAA-style privacy · Tax considerations · Cross-border concerns
Data Classification & Retention
Classifying data determines how it's protected; retention policy determines how long you're required to keep — or destroy — it.
Microsoft's classification levels
- Non-business
- Public
- General
- Confidential
- Highly Confidential
In the shared responsibility model, data classification is the customer's job — the CSP doesn't know what your data contains. Amazon Macie and Azure Information Protection are two CSP tools that help.
Three types of holds
| Hold type | Triggered by |
|---|---|
| Legal hold | Anticipated litigation — freezes data as evidence, prevents deletion/modification |
| Contractual hold | Partner/vendor agreements requiring retention |
| Regulatory hold | Industry regulation (banking, medical) — may set both minimum and maximum retention |
Industry Standards
Four names come up constantly: SOC2, PCI DSS, ISO 27000, and the Cloud Security Alliance.
| Standard | Focus |
|---|---|
| SOC2 | Privacy, security, availability, processing integrity, confidentiality — for vendors handling your data |
| SOC3 | Public-facing summary of SOC2 — used by CSPs to reassure customers |
| PCI DSS | Secure handling of credit/debit card transactions |
| ISO 27001 | Information security management system (ISMS); defines the CIA Triad |
| ISO 27017 | 37 recommendations specifically for cloud security |
| ISO 27018 | Protection of personally identifiable information (PII) in the cloud |
| CSA / CCM | Cloud Controls Matrix — assessing and auditing cloud deployments |
Access Control Fundamentals
Least privilege underpins everything else in this module — zero trust just applies it continuously, everywhere.
Zero trust components
- Granular access controls — microsegmentation, policy-driven
- Continuous authentication — verified per request, not just at sign-on
- Zero implicit trust — no device is trusted by default, internal or not
- Dynamic security — automatic response to deviations
| Zero trust need | AWS example |
|---|---|
| Network path security | Elastic IP, WAF |
| Monitoring | CloudTrail, CloudWatch, Inspector, GuardDuty |
| Encryption | Key Management Service |
Azure's zero trust core is Conditional Access — the policy engine that enforces access rules against users, data, and applications.
Hardening & Benchmarks
Hardening in one line: remove what you don't need, and keep the most current version of what's left.
OS hardening steps
- Maintain security baselines · Automate configuration management · Change default accounts · Change default settings · Patch regularly · Control remote access (SSH/RDP) · Review logs · Maintain antivirus · Back up data
CIS Benchmark levels
| Level | What it means |
|---|---|
| Level 1 | Baseline configurations, immediate returns |
| Level 2 | Additional layered settings — may affect performance |
Patch types
| Type | Notes |
|---|---|
| Patch | Scheduled, predictable release cadence |
| Hotfix | Urgent, unscheduled, targets a specific bug |
| Virtual patch | Applied at the WAF, not the app code — often temporary |
| Rollup | Multiple patches bundled for fast new-VM deployment |
Encryption
Encryption isn't just confidentiality — it also proves integrity and non-repudiation.
Three goals of encryption
- Confidentiality — only key holders can read it
- Integrity — hashing detects unexpected changes
- Non-repudiation — digital signatures confirm the sender
Data at rest
| Type | Examples |
|---|---|
| Drive encryption | LUKS (Linux), BitLocker (Windows) |
| File encryption | gzip, Windows EFS |
API, Container & Storage Security
Three more surfaces where least privilege has to show up in practice, not just policy.
API gateway responsibilities
- Authenticate connections · Control traffic · Rate limiting/throttling · Log and monitor usage
Privileged vs. unprivileged containers
| Privileged | Unprivileged | |
|---|---|---|
| Runs as | Root | Non-root, mapped to a non-root host account |
| If it escapes | Full host access | Contained, reduced attack surface |
| Recommended? | Avoid unless absolutely necessary | Default for modern workloads |
File vs. object storage — shared best practices
- Encrypt data at rest, manage keys carefully
- Test for integrity
- Least-privilege access controls via IAM
- Versioning for rollback
- Cross-region replication for durability
Troubleshooting Security Issues
Most security tickets trace back to authentication, authorization, or an unencrypted path somewhere. Try a symptom below.
Authorization vs. authentication — quick test
| Authentication | Authorization | |
|---|---|---|
| Question | Who are you? | What can you do? |
| Fails as | Can't log in at all | Logs in, but can't reach a resource |
Exam Keyword Flashcards
Tap a card to flip it.
Quick Self-Check
Four questions pulled straight from the module.